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Abstract 

The existing theory of decoy-state quantum cryptography assumes the exact control of each 
states from Alice's source. Such exact control is impossible in practice. We develop the theory 
of decoy-state method so that it is unconditionally secure even there are state errors of sources, 
if the range of a few parameters in the states are known. This theory simplifies the practical 
implementation of the decoy-state quantum key distribution because the unconditional security 
can be achieved with a slightly shortened final key, even though the small errors of pulses are not 
corrected. 

PACS numbers: 03.67.Dd, 42.81. Gs, 03.67.Hk 
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I. INTRODUCTION 

Most of the existing set-ups of quantum key distribution (QKD) use imperfect 

single-photon source. Such an implementation in principle suffers from the photon- number- 
0, Q. The decoy-state method 0, S Q, 11, Q 



splittin g at tack 




[121 and some other methods 



can be used for unconditionally secure QKD even Alice only uses an imperfect 

source la, |7|. 

n 

The separate theoretical result of ILM-GLLP [5] shows that a secure final key can be 
distilled even though an imperfect source is used in the protocol, if one knows the lower 
bound of the fraction of those raw bits generated by single-photon pulses from Alice. The 
decoy-state method is to verify such a bound faithfully and efficiently. The ILM-GLLP 
theory does not need the exact value of the fraction of raw bits due to single-photon pulses 
from Alice. It only needs the lower bound of fraction of un-tagged bits. The goal of decoy- 
state method is to verify such a lower bound through the observed experiment data. 

Recently, a number of experiments on the decoy-state QKD have been done 19|, |20 |. 
However, the existing decoy-state theory assumes the perfect control of the source states 
in the photon number space. This is an impossible task for any real set-up in practice. 
A new problem arose in practice is how to carry out the decoy-state method securely and 
efficiently given the inexact control of the source. Even though one can control the pulse 
intensity pretty well in practice, we still need quantitative criteria on the effects of possible 
small errors in the source states. By currently existing technology, the source error can be 
polynomially small rather than exponentially small. One may argue sine the source error is 
very small, the error-free decoy-state theory must work. But we never know how small is 
sufficiently small so that the error can be securely regarded as 0. If we judge 20% of intensity 
error is too large, we have no reason to say 1% error is small enough for unconditional security 
with error-free decoy-state theory. There are also problems in evaluating the different set- 
ups. Suppose there are two set-ups, A and B, they can make QKD for the same distance. 
Set-up A can have a key rate of 100 bits per second with possible intensity error of 3% 
while set-up B can have a key rate of 80 bits per second with possible intensity error of 1%, 
we don't know which one is better. To answer all these questions, we need a more general 
theory that directly applies to the case with state errors. If we have a stable two-value 
attenuator, we can use the method in Ref. 23|]. If the parameter errors of states of each 
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pulses are random and independent, we can apply the existing decoy-state method with the 



averaged-state 
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22|. 



Here we study the decoy-state method with state errors of Alice's source without any 
of the above presumed conditions. Our result here is not limited to the intensity error 
only, it applies to the more general case of state errors from the source. For example, 
in the protocol using coherent states, intensity error is only a special type of error which 
changes one parameter in the coherent state only, but the state is still a coherent state, 
i.e., a Possonian distribution with another parameter. Generally speaking, there could be 
certain types of sour errors with which the state is not a coherent state, i.e., not in the 
Possonian distribution. Our study shows that the decoy-state method is still secure even 
with state errors, but the key rate will be decreased. Our result only needs the range of a 
few parameters in the source states, regardless of whatever error pattern. In our method, 
we have assumed the worst case that Eavesdropper (Eve.) knows exactly the error of each 
pulse. Our result immediately applies to all existing experimental results. 

This paper is arranged as the following. After the introduction above, we review the 
main idea and basic assumptions of the existing error-free decoy-state theory. As a result, 
the most general condition and formula for the error-free decoy-state method are given. We 
then study the main problem of this paper: the decoy-state method with state errors from 
the source. After pointing out the consequence of the source errors, we present a general 
formula where only the bound values of a few parameters in the states are involved. The 
result is secure even in the case Eve. knows exactly the error of each pulse. We then point 
out that our theory can be applied in the practical set-ups with state errors, such as the 
decoy-state Plug-and-Play protocol raised by Gisin group |25|. The paper is ended with a 
concluding remark. 



II. REVIEW OF THE EXISTING ERROR-FREE DECOY-STATE THEORY 



We call the existing theory 



IG 
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3, 
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15| error-free theory because it assumes no 



error 
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br the source states in the photon-number space. Although most of the literatures [8|, 



11| study the error-free decoy-state method only with specific distributions of source 



states, the assumption of a specific distribution is actually not necessary. Basically, we only 
need a few conditions for the source states rather than the complete distribution function. 



3 



Here we summarize the existing theory in the extended format. 

In the 3-intensity protocol, Ahce has three sources, source Yq which can produce vacuum 
only, source Y which can only produce state 

J 

p = J2ak\k){k\ (1) 

k=0 

only, and source Y' which can only produce state 

J 

P' = E<I^)(^I (2) 

k=0 

only, where \k) is the A;— photon Fock state and > 0, a'^ > for all k, J^^^k = X^'^fc — 
1. Here J can be either finite or infinite. Given a coherent-state source or a heralded 
single-photon source from the parametric down conversion, J = oo. When a coherent-state 



source 



8, 



30, 



llj or a heralded single-photon source [13|, llJ] is used, the parameters a^, a'l^ 



are determined by the intensity (averaged photon number) of a pulse. 

For simplicity, we shall also call source Yq, ^' the vacuum source, the decoy source, 
and the signal source, respectively. Pulses from the decoy source or the signal source are 
called the decoy pulses or the signal pulses, respectively. In the protocol, Alice may use each 
source of [Yq, Y, Y'} randomly with probabilities Po,P,p' {po+P+p' = 1) whenever she sends 
out a pulse to Bob. Given the states in Eqs. ffTpi) . we can equivalently regard that source 
Y or Y' as a probabilistic photon-number source which sends out a A;-photon pulse (photon 
number state \k)) with probability distribution {a^} or {ct'^}. The task here is to verify the 
lower bound of the raw bits caused by those single-photon pulses from Alice. Alice and 
Bob can not directly observe the number of single-photon counts because they don't know 
which pulses at Alice's side are single-photon pulses. They only know which pulse belongs 
to which source and the states of each source. The decoy-state theory shows that they only 
need to know the number of counts due to the pulses from each sources in order to verify 
how many raw bits are generated from the single-photon pulses from Alice. 

We first define the counting rate of a class (or a sub-class) of pulses. A class or a sub- 
class can be any set or subset of pulses from Alice. In the 3-intensity decoy-state method, 
Alice has 3 sources. Here we shall regard each source as a class, and all those fc-photon 
[k = 0, 1, 2, ■ ■ ■) pulses from the same source as a subclass. Given any class X that contains 
Mx pulses, after Ahce sends them out to Bob, if Bob observes n counts at his side, the 
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counting rate for pulses in this class is 

= n/Mx. (3) 

If class X is divided into J sub-classes and any pulse in class X belongs to and only belongs 
to one subclass and the fractions of pulses in each subclasses are bo,bi - ■ ■ , bj, then the 
counting rate of class X is 

J 

Sx = J2^kSk (4) 

fc=0 

and Sk is the counting rate of the kth subclass. This is simply because the total counts of a 
class equals to the summation of counts of each sub-classes, i.e., 

J 

n = ^ nfc (5) 

and rik is the number of counts at Bob's side caused by pulses in the kth sub-class from 
Alice. We denote the counting rates of the decoy-source (class Y), the signal source (class 
Y'), and the vacuum source (class Yq) by S, S', and Sq, respectively. Since in the protocol, 
Alice knows which pulse is from which source, these S, S', and 5*0 can be observed directly 
in the experiment therefore we regard them as known parameters. Given the state of the 
decoy pulses in Eq.([T]), the fraction of A;— photon pulses is a^. Then we have 

J 

5" = ^ ttkSk = aoSo + oisi + X (6) 

fe=0 

and Sk is the counting rate of those fc— photon pulses from source Y, and 

J 

A = ^afcSfc. (7) 

k=2 

Similarly, we also have 

'^' = E<4 (8) 

fc=0 

and is the counting rate of those fc— photon pulses from source Y', S' is the counting rate 
of all pulses from source Y'. 

Asymptotically, the counting rate of the sub-class of those fc-photon pulses from the decoy 
source and the sub-class of those A;-photon pulses from the signal source must be equal 

Sk = 4 (9) 



if the pulses from these two subclasses are randomly mixed. According to this, we also have, 



so = Sq = So, (10) 

Here So is the counting rate of class Iq- In the protocol Alice randomly uses three sources 
therefore those /;;-photon pulses from the decoy-source and those A;-photon pulses from the 
signal source are randomly mixed. We can rewrite Eq.® in the format 

S' = 'S~] a'^Sk = a^so + a[si + —A + S (11) 



and 



Obviously, 



if 



On 



6 = J2a',s,-^X. (12) 

k=2 ^2 



6>0 (13) 



a'l. a 



^ ^ ^ ^ (14) 

Ctfe CL2 Cbi 

Given Eg. ( |6][TT| ) . one can find the following fact 

, a'^iS - aoSo) - a2{S' - a'^so) , 02'^ /i^-x 
si = s-^ = ^- — . (15j 

Since S >0, and the second inequality in Eq. (fT^ is 

agCii — a[a2 > 0, (16) 

therefore , — > 0. The minimum value of the single-photon counting rate is now 
verified to be 

_ / ^ (^2i^ ~ ^O^o) ~ 0,2{S' — do-So) ,.r,\ 

Si — s^^ -, • l-'-'J 

0201 — 0^02 

The fractions of the single-photon counts for the signal source and the decoy source are 
therefore 

a; = ^. a. = ^. (18) 

Given these, one can calculate the final key rate of each source, e.g., the final key rate for 

nn 

the signal source is by[5|, lUlj 

R, = A[[1-H{h)]-H{t) (19) 
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where ti, t are the QBER for single-photon pulses and the QBER for all signal pulses. This 
is the (extended) result of the decoy-state method with diagonal states in photon number 
space, including the coherent states, thermal states, heralded single-photon states, and so 
on with the condition that the source states are exactly controlled and Eq. flT^ holds. 



III. CONSEQUENCE OF SOURCE ERRORS: 7^ 

However, the results above are based on the assumption that all states are produced 
exactly. Now we study the the consequence of the source errors in an actual protocol. 

A very tricky point here is that Eq.([9]) is in general incorrect, if there are state errors. We 
emphasize that this issue was first pointed out by us in a number of places. For example, in 
the shorter version of our work 24| (in the text around Eq.(ll) there), and also in section 
4.3.5 of Ref. [sj]. In all these places we have clearly stated the issue. Here we present the 
main idea about this point and also the reason behind: 

Eq.Q is the most important element of the error-free decoy-state theory. Now we explain 
why we don't use Eq.([9]) here if we assume Eve. knows the state errors. 

For simplicity, we consider the following two-block collective errors with coherent states: 
Alice wants to use intensity /i = 0.2 for decoy pulses and intensity /i' = 0.6 for signal pulses. 
However, in some blocks (strengthened blocks), both decoy pulses and signal pulses are 
10% stronger than the assumed intensity, in the other blocks (weakened blocks), both decoy 
pulses and signal pulses are 10% weaker than the assumed values jsl. Suppose Alice always 
with probabilities of Po,P,p' to choose one of three different sources (the vacuum source, the 
decoy source, and the signal source source). The density operator of a coherent state with 
intensity x is 



00 I. 

X 



fc=0 

Here is Eve's scheme using time-dependent channel: she blocks all pulses from the 
weakened blocks, and she produces a linear channel of transmittance 2?7e to attenuate each 
pulse from the strengthened block. Straightly, the actual counting rate of those single-photon 
pulses from the decoy source is 

(0.9/xe-o-9'^ + l.l/ie-i-i'^)/2 
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and the actual counting rate of those single-photon pulses from signal source is 

" (O.Ve-o-V + l.l/i'e-ii^')/2' 

We find 



(22) 



e°-2^' + 1.1/0.9 , , 
= e°'^^ + 1.1/0.9 ^ 

Similarly, we can also show that Sk s'^. for any k. This shows, given the collective error 
which is known to Eve, Eve can treat the identical /c— photon pulses differently according to 
which source the are from ! 

The reason behind the above result is because the collective errors may break the "random 
mixture" condition of Eq.Q. Consider again the specific example above. Consider those 
single-photon pulses only. In a strengthened block, a single-photon pulse has probability 

l.lnue-^-^'^ 1 , , 

-p = lH = (24) 

' Llp/ie-i-i/^ + l.lpVe-i-i^' 1 + l^ei-i('^-/^') 
to be from the decoy source; and probability 

^ l.lpVe"^-^^' ^ 1 , . 

' l.lp/ie-i-iA' + l.lpye-i-i^'' 1 + ^ei-i('^'-A') ^ ^ 

to be from the signal source. In a weakened block, a single-photon pulse has probability 

= 1 + £VeO-9(/^-/^') ^^^^ 
that it comes from the decoy source; and probabihty 

V' = - (27) 

' w I VM_q0.9{h'-h'\ ^ > 

p' ^i' ' 

that it comes from the signal source. These values show that the single-photon pulses in the 
weakened blocks are more probably from the decoy source than those single-photon pulses 
in the strengthened blocks. Also, the single-photon pulses in the weakened blocks are less 
probably from the signal source than those single-photon pulses in the strengthened blocks. 
These patterns have surely broken the random mixture presumption of Eq.Q. 

One may question how Eve. can know the state errors. In the decoy-state plug-and- 



play protocol 25|, Eve. can actually prepare the error pattern, including the above specific 
pattern. (Suppose Ahce only wants to monitor each pulse but she does not want to cost too 
much to correct the the error of each individual pulse.) 
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Even in the one-way protocol, Eve. can also know the intensity errors if Alice does not 
want to cost too much to correct each individual pulse. Indeed, in the practical set-ups, 
the intensity fluctuation appears collectively to blocks of pulses. Eve. can know the error 
patterns by studying the averaged photon number block by block. 

In principle, Alice might be able to correct the error of each individual pulses in a real 
set-up. But, with the theoretical result of this work, Alice does not have to do so. She only 
needs to know the range of a few parameters of the source. 

IV. DECOY-STATE METHOD WITH STATE ERRORS 

We still assume that each pulse sent out by Alice is randomly chosen from one of 3 sources 
Yq,Y,Y' with probability po,p,p', respectively. For simplicity, we assume that every pulse 
in class Yq is exactly in vacuum state. But each single-shot of pulses in classes Y (the decoy 
source), and Y' (the signal source) can be in a state slightly different from the expected one. 
Eq.(l5]) still holds even though there are source errors, because it is simply the definition of 
summation. Also, we shall still use Eq. ([3]) for the definition of counting rate of a certain class 
which contains many pulses. Suppose Alice sends M pulses to Bob in the whole protocol. 

A. Virtual protocol 

For clarity, we first consider a virtual protocol. 
Protocol 1: At any time i, each source produces a pulse. The states of the pulses from 
sources Yo,Y ,Y' are |0)(0|, 

J 

Pi = '^aki\k){k\ ; and (28) 

k=0 

J 
fc=0 

Here p,, and p' can be a bit different from p and p' of Eq.([T], [2]), which are the assumed 
states in the perfect protocol where there is on source error. At any time i, only one pulse 
is selected and sent out for Bob, and the probability for a pulse to be selected and sent 
out is constantly po, p, and p' if the pulse is from vacuum source (decoy-source or signal 
source). The un-selected two pulses at each time will be blocked and absorbed. After Bob 
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has completed all measurements to the incident pulses, Alice checks the record about which 
pulse is selected at each time, i.e., which time has used which source. 

As shown below, based on this virtual protocol, we can formulate the number of counts 
from each source and therefore find the lower bound of the number of single-photon counts. 
The result also holds for the real protocol where Alice decides to use which sources at the 
ith time in the beginning with the same probability distribution pq, p and p'. In this case, 
at each time i, only one source emits a pulse. 

B. Our goal 

Our goal is to find the lower bound of the fraction of counts caused by those single-photon 
pulses for both the signal source and the decoy source. The following quantities are directly 
observed in the protocol therefore we regard them as known parameters: A^^^, the number of 
counts caused by the decoy source, and Ng, the number of counts caused by the signal source, 
and A'o, the number of counts caused by the vacuum source, Yq- Obviously, S = the 
counting rate of the decoy source, and = the counting rate of the signal source, and 
5*0 = -^^1 the counting rate of the vacuum source, are also known exactly in the protocol. 
Clearly, here pM, p'M and poM are just the number of the decoy pulses, the number of the 
signal pulses, and the number of pulses from the vacuum source, respectively. Therefore, 
for our goal, we only need to formulate the number of counts caused by those single-photon 
pulses from each sources in terms of these quantities and Po,P,p' and the bound values of 
those parameters aki,a'i^^ as appear in Eq. fl28ll29p . 

C. Some definitions 

Definition 1. In the protocol, Alice sends Bob M pulses, one by one. In response to 
Alice, Bob observes his detector for M times. As Bob's ^th observed result, Bob's detector 
can either click or not click. If the detector clicks in Bob's ith observation, then we say that 
"the zth pulse from Alice has caused a count" . We disregard how the ith pulse may change 
after it is sent out. When we say that Alice's ith. pulse has caused a count we only need 
Bob's detector clicks in Bob's ith observation. 

Given the source state in Eqs. (12811291) . any ith pulse sent out by Alice must be in a photon- 
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number state. To anyone outside Alice's lab, it looks as if that Alice only sends a photon 
number state at each single-shot: sometimes it's vacuum, sometimes it's a single-photon 
pulse, sometimes it is a A;— photon pulses, and so on. We shall make use of this fact that 
any individual pulse is in one Fock state. 

Definition 2, set C and c^: Set C contains any 5-pulse that has caused a count; set 
contains any /e— photon 5-pulse that has caused a count. Mathematically speaking, the 
sufficient and necessary condition for i G C is that the ^th pulse has caused a count. The 
sufficient and necessary condition for i G Cfc is that the ith pulse contains k photons and it 
has caused a count. For instance, if the photon number states of the first 10 pulses from 
Alice are |0), |0), |1), |2), |0), |1), |3), |2), |1), |0), and the pulses of i = 2, 3, 5, 6, 9, 10 
each has caused a count at Bob's side, then we have 

C = {i\i = 2, 3, 5, 6, 9, 10, ■ ■ ■}; cq = {i\i = 2, 5, 10, ■ ■ •}; ci = {i\i = 3, 6, 9, ■ ■ ■}. (30) 

Clearly, C = cq U ci U C2 ■ ■ ■, every pulse in set C has caused a count. 

Definition 3. For any k > 0, for the parameters in Eqs. fl28l [29]) . we denote and the 
minimum value and maximum value of {ctfcil ^ = I5 2, ■ ■ ■ M}; a'^ and a'^ the minimum value 
and maximum value of {a'^jl i = 1,2, ■ ■ ■ , M}. We assume these bound values are known in 
the protocol. 

D. Number of vacuum counts 

Here we shall give the explicit formulas to bound uq^, the number of counts caused by 
those vacuum pulses from the decoy source, and n'^^, the number of counts caused by those 
vacuum pulses from the signal source. We want to formulate them by the known quantities, 
such as A^o, the number of counts by the vacuum source (source Yq), or 5*0, the counting rate 
of the vacuum source. 

Given the definition of the set c^, the number of counts caused by all vacuum pulses is 
just the number of pulses in set Cq. We want to know how many of the vacuum counts are 
caused by each source. This is equivalent to ask how many of pules in set Cq come from each 
source. A vacuum pulse can come from any of the 3 sources, the vacuum source (Yq), the 
decoy source (Y) and the signal source {Y'). According to Eqs.(!28| [29l) . if the ith pulse is 
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vacuum, the probability that it comes from the vacuum source (Iq) is 

-p - Po 

'm\o — : : — pr- 

Asymptotically, in set Cq, the population of pulses from source Yq is 

'Pvi\o- 

This is also the number of counts caused by source Yq, since every pulse in cq has caused a 
count. Therefore the observed number of counts caused by source Yq must satisfy 



No = J2Podo^ (31) 



iGco 

Here 

do^ = ^ \ w • (32) 

Po + paoi + pa-oi 

Similarly, if the zth pulse contains photon, it has a probability Vdi\o = p^^pl'^°i_p,^i to be 
from the decoy source, and a probabihty of Vsi\o = pp_|_pao"+p'a' from the signal source. 

Therefore we have 

nod = ^ Vdiio = ^paoidoi, (33) 
for the number of counts caused by those vacuum pulses from the decoy source, and 

"os = '^^^10 = P'^'oAu (34) 

for the number of counts caused by those vacuum pulses from the signal source. Therefore, 
with our Definition 3, nod, n'^^ are bounded by 

= P(^o Y - '^0'^ - P"'0 Y '^0* ^ (35) 

and 



Os 



p'a'o Y doi > nod > p'a'o ^ doi = n'^^. (36) 



TTriV 



Using the fact ^jg,, (ioi = — from Eq. (l3T!) . we replace the above two equations by 



. > > (37) 

Po Po 
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By definition, the counting rate of source Yq is 5*0 = tlierefore tfie above equations are 
equivalent to 



iT'Od = clqPSqM > nod > a^pSoM = n, 



Od 



n, 



= a[,V5oM > n',^ > a'^p'SoM = (38) 



E. Calculations and main formulas 

According to our definition of set C earlier, every pulse in set C has caused a count. 
Therefore, the population of the decoy pulses (signal pulses) in set C is just A^^ (or Ng), the 
number of counts of the decoy source (signal source). Asymptotically, 

J J 

k=0 i&Ck i(zCi k=2 i^c^ 

J J 

fc=0 i£C(; igci k=2 i&Cf^ 

and 'Pdi\k (or 'Psi\k )is the probability that the ^th pulse comes from the decoy source (or 
signal source); if the zth pulse contains k photons. Here we have used Eqs. (l33l 

Consider those /;;-photon pulses {k > 1). A A;-photon pulse can come from either the 
decoy source or the signal source. 
Fact : Define 



dki = ^v^' ^ ^ 1' (41) 



if the zth pulse contains k photons, it has a probability pa^idki to be from the decoy source 
(source F), and a probability p'a'i^-dki to be from the signal source (source Y'), if k > 1. 
This is to say, Vdi\k in Eq. (l39l) and Vsi\k in Eq. (l40|) are given by 

Vdi\k = pakidki (42) 

and 

'Psi\k = p'a'kidki (43) 
Therefore, Eqs. (!39l |40|) can be re- written in the following equivalent form 

Nd = nQd + P^aiidu+p^^akidku (44) 

j£ci k=2 i&Ck 
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iSci k=2 idCf^ 

Our goal as stated in the subsection IIVBI is simply to know the minimum value of 

Di = Y,dii. (46) 

For, with this and Definition 3, the minimum value of the number of counts caused by 
single-photon pulses from the signal-source (or the decoy-source) is simply 



< = p'a'I^Di < ri'i,, (or n^^ = pafDi < um). 

In what follows we shall find the formula of Di in terms of A^^^, Ng, riod, n'^^s based on Eqs. 
5]). [nQd,nQg have been given in Eq (!37|) ]. Eqs. (144| H5l) can be written in 



(47) 



where 



and 



k=2 i&Ck k=2 i£ci. 



6 = p 
6 =p 



a^Di + A - I ^ aiidii + ^ ^ a,kid, 

k=2 i€Ck 



ki 



Yl "'li^i* + 5Z 5Z ^'ki^^' ~ [a'lDi + A') 

k=2 i&Cf^ 



> 



> 



According to the definition of A and A', we also have 



A' = V + ^s 



and 



fL 



Further, we assume the important condition 



a'L n'^ 

^ > ^ > for all k>2. 

Oij^ ^2 ^1 



The first inequality above leads to 



e3>0 



(48) 
(49) 

(50) 



(51) 



(52) 



(53) 



(54) 
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as one may easily prove. With Eq. (l5T!) . Eq. (H9i) is equivalent to 



Ns = n',, + p'afD^ + p'%k + 6 + 6 (55) 



iL 



Given the Eqs.(H8| [55|l . we can formulate Di. 

- af 4^ - af4 ■ ^^^^ 

Since ^1,^2, and 6 are all non-negative, and 0^02''" — a'/'a^ > by the second inequality of 
Eq-dMD, we now have 

a'^Nd/p - a^Njp' - a'^n^dlp + a^n'^Jp' 
af - af4 " ^^^^ 

The bound values of nod, n'^^ have been given by Eq.flTTt [55]) in the earlier subsubsection. 
Therefore, we can now bound the fraction of single counts among all counts caused by the 
signal source 



p'afDi a'l^{a'^Ndp'/p - a^jN, - p' a'j^ Np / pp + a^a'i^ N^p' /p^, 



According to Eq. (l47l) . p'a'^Di is the lower bound of the number of counts caused by single- 
photon pulses from the signal source. Here we have replaced nQd in Eq.( l57|) by its upper 
bound and by its lower bound as given in Eq. (!371) . Using Eq. (!38l) . we can write the 
right-hand-side of the inequality in terms of counting rates: 



A / \ '^'1^ ('^2^'^ ~ a^S" — a'2aQSo + a^a[f 5*0) . 



where S' = is the counting rate of the signal source, S" = ^ is the counting rate of the 
decoy source, and M is the total number of pulses as defined earlier. Similarly, we also have 

' - 5(afa'2^-a'M) ^ ^ 

for the minimum value of fraction of single-photon counts for the decoy source. 

Eqs. ( 153| [581 [59i) and ( I6OI) are our main results of this work. The results are based on the 
virtual protocol where Alice checks which source is used at each time after Bob's detection. 
Obviously Alice can choose to check the information before sending out the pulses, i.e., Alice 
can decide which source to be used at each time in the very beginning. This is then just the 
real protocol of the decoy-state method. 
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TABLE I: Secure key rate (R) vs different values of intensity error upper bound {6m) using the 
experimental data in the case of 50 km {20^. The experiment lasts for 1481.2 seconds with the 
repetition rate 4 MHz. We have observed S' = 3.817 x IQ-"^, 5 = 1.548 x 10^^, = 2.609 x 10"^ 
and the quantum bit error rates (QBER) for signal states and decoy states are 4.247%, 8.379% 
respectively. The relative fractions of the signal pulses, decoy pulses and the pulses from the 
vacuum source are 0.50269: 0.40726: 0.09006. The final key rate is calculated by Eq. (|19p and we 
use the formula ^'•^/'^ for ti in Eq. (jl9p . 



6m 5% 


4% 


3% 


2% 


1% 





R (Hz) 70.8 


84.3 


97.6 


110.7 


123.6 


136.3 



For coherent states, if the intensity is bounded by [/i"^, fi^] for the decoy pulses and 
for the signal pulses then 

4 = (/i'')'e-^"/A:!, af = (^'^)'=e-^'"/fc! (61) 

with X = L, U and k = 1,2 and 

= e-'^^ = e"^' a[f = e-^'^ a'^ = e-^"" (62) 

Therefore, one can calculate the final key rate by Eg. (1191) now, if the bound values of 
intensity errors are known. The asymptotic result using the experimental data of QKD over 
50 kilometers calculated by our formula is listed in table I. 



V. APPLICATION IN THE PLUG-AND-PLAY PROTOCOL 

As shown by Gisin et alj^], combining with the decoy-state method, the plug-and-play 
protocol can be unconditionally secure. There, Alice receives strong pulses from Bob and 
she needs to guarantee the exact intensity of the pulse sending to Bob. It is not difficult to 
check the intensity, but difficult to precisely correct the intensity of each individual pulses. 
Our theory here can help to save the difficult single-shot feed-forward intensity control: Alice 
monitors each pulses, to reduce the cost of the set-up, she may only do crude corrections 
to the pulses, or she may simply discard those pulses whose intensity errors are too large 
(e.g., beyond 2%), and then use our theory with the known bound of state errors. In the 
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Plug-and-Play protocol, Eve. actually knows the error of each individual pulse hence the 
error-free decoy-state theory based on Eq.Q fails but our theory here works. 

VI. CONCLUDING REMARK AND DISCUSSIONS 

In summary, we have for the first time shown the unconditional security of decoy-state 
method given what-ever error pattern of the source, provided that the parameters in the 
diagonal state of the source satisfy Eq.( |53l) and the bound values of each parameters in the 
state is known. Our result also answers clearly the often asked question "What happens 
if the state of Laser beam is not exactly in the assumed distribution ?". Our result can 
be directly applied to the Plug-and-Play decoy-state protocol and simplify all the existing 
protocols in practical use. Our result here can be extended to the non-asymptotic case 
by taking statistical fluctuations into consideration in Eqs.( [321 SD])- This will be reported 
elsewhere. 
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